@impeccable/reviews 0.1.18 → 0.1.20

package/dist/host-questions.js

@@ -228,6 +228,18 @@ export function sentTo(screen, url) {
     const line = `This run sends it first to ${url}, to prove it opens before anything saves it.`;
     return screen.kind === 'confirm' ? screen : { ...screen, prompt: `${screen.prompt} ${line}` };
 }
+/** On a second Netlify site behind a password, the offer to use the one the person typed for another site of this run (#384); on Skip, the paste screen. */
+export function netlifySamePassword(site, other) {
+    return {
+        id: 'netlify-password-same',
+        kind: 'confirm',
+        title: 'Your Netlify previews are protected',
+        hint: `The previews of the Netlify site ${site} are behind its site password too. The run tries the password you typed for ${other} on ${site}'s preview first, and saves it for ${site} only if it opens.`,
+        prompt: `Use the same password for ${site}?`,
+        confirmLabel: 'Use it',
+        skipLabel: 'Type another',
+    };
+}
 /** The consent to a Vercel bypass secret, naming the project that holds it and, on a repository with several apps, the app whose previews it opens (#358). */
 export function vercelBypassConsent(project, app) {
     const screen = HOST_SCREENS['vercel-bypass'];

package/dist/hosted.js

@@ -1,7 +1,6 @@
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
 import { ACCESS_ID_HEADER, ACCESS_SECRET_HEADER } from './cloudflare-access.js';
-import { basicCredentials } from './netlify-password.js';
 import { gitEnvironment } from './sandbox.js';
 import { BYPASS_HEADER } from './vercel-bypass.js';
 /**
@@ -280,36 +279,43 @@ async function pageText(res, max = 1_000_000) {
     }
     return Buffer.concat(chunks).toString('utf8');
 }
+/** Whether a page is a password form and nothing else: one form whose only field a person fills is a password, as Netlify's lock is. */
+function passwordForm(html) {
+    const seen = html.replace(UNSEEN, ' ');
+    const fields = [...seen.matchAll(/<input\b[^>]*>/gi)].map(([tag]) => /\stype\s*=\s*["']?([\w-]+)/i.exec(tag)?.[1]?.toLowerCase() ?? 'text').filter((type) => !['hidden', 'submit', 'button', 'reset', 'image'].includes(type));
+    return (seen.match(/<form\b/gi) ?? []).length === 1 && fields.join() === 'password';
+}
 /**
- * Whether Netlify's own password form opens the address: the password posted as that form posts it (a `password` field
- * to the address itself), then the page read with the session cookie Netlify set. Says whether a password is right
- * where the header did not open the address; a review cannot fill a form, so this proves nothing for one.
+ * Signs in with Netlify's site password the way its form does, and the way reviews do (pristine's site-password.ts):
+ * a stranger's knock on the address's own origin, then, only where the answer is the lock's password form, the
+ * password posted there as its one field. Netlify answers a redirect back with a cookie for that host alone, which
+ * opens every page of it; a wrong password gets the form again and no cookie. The session's cookies, as a request
+ * sends them; empty where nothing stood in front or the form did not take the password.
  */
-async function formOpens(target, password, phrase, open, signal) {
+async function siteSession(target, password, open, signal) {
+    const front = new URL('/', target.origin);
     try {
-        const posted = await open(target, { method: 'POST', redirect: 'manual', credentials: 'omit', signal, headers: { accept: 'text/html', 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ password }).toString() });
-        await posted.body?.cancel().catch(() => { });
-        const cookies = posted.headers.getSetCookie().map((cookie) => cookie.split(';')[0]).filter((pair) => pair.includes('='));
-        if (posted.status >= 400 || !cookies.length)
-            return false;
-        const res = await open(target, { redirect: 'manual', credentials: 'omit', signal, headers: { accept: 'text/html', cookie: cookies.join('; ') } });
-        if (res.status < 200 || res.status >= 300) {
-            await res.body?.cancel().catch(() => { });
-            return false;
+        const knock = await open(front, { redirect: 'manual', credentials: 'omit', signal, headers: { accept: 'text/html' } });
+        if ((knock.status !== 401 && knock.status !== 403) || !passwordForm(await pageText(knock, 64_000))) {
+            await knock.body?.cancel().catch(() => { });
+            return '';
         }
-        return visible(await pageText(res)).includes(plain(phrase));
+        const posted = await open(front, { method: 'POST', redirect: 'manual', credentials: 'omit', signal, headers: { accept: 'text/html', 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ password }).toString() });
+        await posted.body?.cancel().catch(() => { });
+        if (posted.status >= 400)
+            return '';
+        return posted.headers.getSetCookie().map((cookie) => cookie.split(';')[0].trim()).filter((pair) => /^[^\s;,=]+=[^\s;,]*$/.test(pair)).join('; ');
     }
     catch {
-        return false;
+        return '';
     }
 }
 /**
  * Opens a preview address the way a visitor does, signed in nowhere, and proves it: it answers, and its page shows
  * `words` that a file of the checkout at `root` holds, so the page is this app's and not another site's. With `bypass`, a
  * Vercel bypass secret, a Vercel address is opened with it in the header Vercel reads it from, as reviews do; with
- * `password`, a Netlify site password, a Netlify address is opened with it as basic credentials in the Authorization
- * header, the one way reviews can send it, and with `form` posted to Netlify's form too where the header did not get past
- * the lock (only for a site whose settings show a password: an app's own password form looks the same); with `access`, a
+ * `password`, a Netlify site password, a Netlify address is opened signed in with it on Netlify's own form, as reviews
+ * sign in, the password posted only where the address's origin answers with that form; with `access`, a
  * Cloudflare Access service token, a Pages address is opened with it in the two headers Access reads it from. None goes
  * to another host. With `live`, the address is a live app's rather than a preview's: any https address is opened, a
  * host's lock is told by its domain, or by the host named in `live` for a custom domain the host tool answered as the
@@ -333,10 +339,12 @@ export async function provePreview(url, words, root, deps = {}) {
     const opened = deps.bypass && host === 'vercel';
     const withPassword = deps.password !== undefined && host === 'netlify';
     const withToken = deps.access !== undefined && host === 'cloudflare';
+    // Behind Netlify's site password: the session its form gives, carried on every hop of the address's own origin.
+    const session = withPassword ? await siteSession(new URL(url), deps.password, open, signal) : '';
     const headers = {
         accept: 'text/html',
         ...(opened ? { [BYPASS_HEADER]: deps.bypass } : {}),
-        ...(withPassword ? { authorization: basicCredentials(deps.password) } : {}),
+        ...(session ? { cookie: session } : {}),
         ...(withToken ? { [ACCESS_ID_HEADER]: deps.access.id, [ACCESS_SECRET_HEADER]: deps.access.secret } : {}),
     };
     // Where the login stands in front all the same, the bypass secret, the password or the service token did not get past it.
@@ -364,10 +372,6 @@ export async function provePreview(url, words, root, deps = {}) {
                 const named = (host === 'netlify' && netlifyLock(res.headers.get('www-authenticate'), page)) || (host === 'vercel' && /vercel/i.test(page)) || (host === 'cloudflare' && (/^cloudflare-access\b/i.test(res.headers.get('www-authenticate') ?? '') || /cloudflareaccess\.com|cloudflare access/i.test(page)));
                 if (!gate || !named)
                     return unproven(res.status === 401 ? "The address asked for the app's own sign-in: try a page a visitor opens without signing in." : `The address answered ${res.status}.`, res.status);
-                // A password the header did not get past: Netlify's own form says whether it is the site's password at all.
-                if (withPassword && deps.form && (await formOpens(target, deps.password, phrase, open, signal))) {
-                    return { ...unproven("The password opens the address on Netlify's own form, but not in the Authorization header, the one way reviews can send it.", res.status), gate, formOpened: true };
-                }
                 return { ...unproven(`The address asked for ${lock}'s login or password${still}.`, res.status), gate, ...(host === 'netlify' && NETLIFY_TEAM_LOGIN.test(page) ? { teamLogin: true } : {}) };
             }
             if (res.status < 200 || res.status >= 300) {

package/dist/netlify-password.js

@@ -1,7 +1,8 @@
 /**
  * Getting past Netlify's site password (Password Protection on Pro and Enterprise plans; "Project visibility: Password"
- * on credit-based Pro) the one way a request can carry a password: as basic credentials in the Authorization header.
- * Netlify's password page asks for a password alone, no username, so the credentials carry an empty name. The Netlify
+ * on credit-based Pro) the way Netlify takes it: on its own form, which answers a session cookie for the preview's host
+ * (impeccable-reviews#374); no request header carries it. Reviews sign in the same way, before a preview's first page,
+ * with the password saved as the lock's key (pristine's `protection: { method: "password" }`). The Netlify
  * CLI on this machine, signed in as the person, reads the site's settings in the command's own process: what
  * `netlify api` prints is those settings, the password among them, so the agent's shell never runs it (fence.ts), and
  * no password goes back to the model. The person consents once, on the tool's screen, before the password is stored;
@@ -10,10 +11,6 @@
  * Netlify's team login (a private site) has no way in for tools, so on the person's yes the run makes the site public
  * through the CLI; where Netlify refuses, the person changes Visitor access on Netlify's page and the run tries again.
  */
-/** The header reviews send the password in. */
-export const PASSWORD_HEADER = 'Authorization';
-/** The password as the header carries it: basic credentials with an empty username, since Netlify asks for none. */
-export const basicCredentials = (password) => `Basic ${Buffer.from(`:${password}`).toString('base64')}`;
 /** The CLI's read of a site by the address every deploy preview of it carries (`site_id` takes the site's default domain), an authenticated call of Netlify's API. */
 export const readSiteCall = (site) => ['api', 'getSite', '--data', JSON.stringify({ site_id: `${site}.netlify.app` })];
 /**
@@ -27,7 +24,7 @@ const record = (value) => (value !== null && typeof value === 'object' && !Array
 /** A site's name and id as Netlify makes them. */
 const NAME = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
 const ID = /^[A-Za-z0-9-]{1,64}$/;
-/** A password as the header can carry it: one line, of a length a person would type. */
+/** A password as the form takes it: one line, of a length a person would type. */
 const password = (value) => (typeof value === 'string' && value.length > 0 && value.length <= 200 && !/[\r\n\0]/.test(value) ? value : null);
 /** The site's protection, read through the CLI, which is what makes the site the person's; null when it could not say: signed out, no site of that name in a team of the person's, or a site read back under another name. */
 export async function readSite(run, site) {
@@ -63,12 +60,11 @@ export async function passNetlifyLock(deps) {
     const from = site ? { site: site.name } : {};
     const finish = async (password, how) => {
         deps.remember(password);
-        deps.remember(basicCredentials(password));
-        // Netlify's form, which an app's own password form looks like, gets the password only on a site whose settings show one.
-        const proof = await deps.prove(password, site !== null);
-        // locked: Netlify's lock stood all the same, and its form did not take the password either. Any other failure is the proof's to say: the form took it and the header did not, or the page past the lock is another, or did not answer.
+        // Netlify's form, which an app's own password form looks like, gets the password only on a site whose settings show one: the CLI read this one as the person's.
+        const proof = await deps.prove(password);
+        // locked: Netlify's lock stood all the same, so its form did not take the password. Any other failure is the proof's to say: the page past the lock is another, or did not answer.
         if (!proof.proven)
-            return { reason: proof.reason ?? 'The address did not open with the password.', locked: proof.gate !== undefined && !proof.formOpened };
+            return { reason: proof.reason ?? 'The address did not open with the password.', locked: proof.gate !== undefined };
         const failed = await deps.save(password);
         return failed ? { status: 'save-failed', reason: failed, protection: 'password', ...from } : { status: 'saved', password: how, protection: 'password', ...from, value: password };
     };
@@ -88,7 +84,7 @@ export async function passNetlifyLock(deps) {
                 return done;
             // The site's own password, as Netlify gives it: nothing typed would be righter. Where the lock stood all the same, the page asks for the app's own sign-in past it,
             // which a page a visitor opens gets past, or Netlify did not answer its form; else the proof's reason says what stood in the way.
-            return { status: 'refused', reason: done.locked ? "Netlify's own site password opened the address neither in the header nor on Netlify's form: the page asks for the app's own sign-in past the lock, or Netlify did not answer. Prove a page a visitor opens without signing in, and call this tool again." : done.reason, protection: 'password', ...from };
+            return { status: 'refused', reason: done.locked ? "Netlify's own site password did not open the address on Netlify's form: the page asks for the app's own sign-in past the lock, or Netlify did not answer. Prove a page a visitor opens without signing in, and call this tool again." : done.reason, protection: 'password', ...from };
         }
     }
     else {
@@ -133,7 +129,7 @@ async function openToVisitors(deps, site) {
             return read;
         // A site read as public, or one the CLI cannot read once the person changed it on Netlify's page: the preview says.
         if (read ? !read.teamLogin : tries > 0) {
-            const proof = await deps.prove(undefined, false);
+            const proof = await deps.prove(undefined);
             if (proof.proven)
                 return { status: 'opened', madePublic: ranPublic ? 'run' : 'person', ...from };
             // Past the login, a page that is not the app's: the proof says why.

package/dist/playbook/cases/preview-protection.md

@@ -1,6 +1,6 @@
 ### When this applies
 
-impeccable_prove_preview answered a `gate`: the host's own lock stands in front of a preview the host made, and a visitor gets its login or its password page. Three locks have a way in for a tool, each with a tool of its own that works as the person in the command's own process, so no key ever reaches you: Vercel's Deployment Protection (`gate: "vercel-protection"`: Vercel Authentication, or Password Protection, which shows the same gate), whose way in is a bypass secret of the project, sent in a header, which every plan has; Netlify's site password (`gate: "netlify-protection"`), sent as basic credentials in the Authorization header; and Cloudflare Access in front of a Pages preview (`gate: "cloudflare-access"`), whose way in is a service token that a Service Auth policy of the Access application allows, sent in two headers. Netlify's team login, which the same gate answers for, has none, so the tool makes the site public on the person's yes. A project the Vercel CLI creates starts protected, so vercel-setup's new project ends here as well, and so does netlify-setup's new site on a team that keeps new sites private: these steps come between the proof and the save of the method, in vercel-previews', netlify-previews' or cloudflare-previews' step 2 or vercel-setup's or netlify-setup's step 5, before the test drive's pull request opens (on Netlify, before its draft is marked ready), and end with the preview opened.
+impeccable_prove_preview answered a `gate`: the host's own lock stands in front of a preview the host made, and a visitor gets its login or its password page. Three locks have a way in for a tool, each with a tool of its own that works as the person in the command's own process, so no key ever reaches you: Vercel's Deployment Protection (`gate: "vercel-protection"`: Vercel Authentication, or Password Protection, which shows the same gate), whose way in is a bypass secret of the project, sent in a header, which every plan has; Netlify's site password (`gate: "netlify-protection"`), which reviews type into Netlify's own password form on that site's previews alone, for the session it gives, as a visitor does (no header carries it, so a Netlify site has no bypass key); and Cloudflare Access in front of a Pages preview (`gate: "cloudflare-access"`), whose way in is a service token that a Service Auth policy of the Access application allows, sent in two headers. Netlify's team login, which the same gate answers for, has none, so the tool makes the site public on the person's yes. A project the Vercel CLI creates starts protected, so vercel-setup's new project ends here as well, and so does netlify-setup's new site on a team that keeps new sites private: these steps come between the proof and the save of the method, in vercel-previews', netlify-previews' or cloudflare-previews' step 2 or vercel-setup's or netlify-setup's step 5, before the test drive's pull request opens (on Netlify, before its draft is marked ready), and end with the preview opened.
 
 ### Steps
 
@@ -10,17 +10,17 @@ impeccable_prove_preview answered a `gate`: the host's own lock stands in front
    - `login` (Netlify): Netlify kept its team login in front through the retries; `reason` says so. Step 3.
    - Any answer with `madePublic` but `opened`: the run made the Netlify site public and it stays so, though the preview did not open; the report names that change as the bullet below says, whatever step comes next.
    - `refused` with `protection: "none"` (Netlify: the site's settings show neither a password nor the team login, or the site is public now, `madePublic` saying who made it so, and the page past the login is not the app's), or on Vercel whose `reason` says the settings show no Deployment Protection: the page you proved is the app's own sign-in or another page, however it is worded, and the previews are open. Prove a page a visitor opens without signing in, as vercel-previews' or netlify-previews' step 1 says, and on `proven: true` go on with that case's step 2, the save, calling this tool no more: there is no lock to get past. No such page proven: the host's previews do not show this app to a visitor, so go on as that case's "Another app, or no answer" says (set the preview up as server-previews says, and say under "What is not verified" what the address answered), never step 3, whose lock the settings show is not there.
-   - Any other `refused` on Netlify whose `reason` says to prove or try a page a visitor opens, or that the page asks for the app's own sign-in past the lock: the site password (Netlify's own, or the one typed) got past the lock to the app's own sign-in on the page you proved, or opened neither the header nor Netlify's form, or Netlify did not answer. Prove a page a visitor opens without signing in, as netlify-previews' step 1 says, and call the tool again; the consent is not asked a second time. Refused again, step 3.
+   - Any other `refused` on Netlify whose `reason` says to prove or try a page a visitor opens, or that the page asks for the app's own sign-in past the lock: the site password (Netlify's own, or the one typed) got past the lock to the app's own sign-in on the page you proved, or Netlify's form did not take it, or Netlify did not answer. Prove a page a visitor opens without signing in, as netlify-previews' step 1 says, and call the tool again; the consent is not asked a second time. Refused again, step 3.
    - Any other `skipped` or `refused`: nothing was saved; `reason` says what stopped it. Step 3.
-   - `save-failed`: the setup API did not take it all; `reason` says how far it got. Call the tool once more; when it fails again, step 3, with "Save the Vercel bypass secret on the setup page", "Save the Netlify site password on the setup page" or "Save the Cloudflare service token on the setup page" in `left`.
-2. **Check it from Impeccable's side**: impeccable_write to `connection-check` with `{"appKey": "main"}` (on a repository with several apps, the app's own key: the tool saved the key for that app), and report what it answered. Then go on with the case that sent you here: the proof stands, so save the method as vercel-previews', netlify-previews' or cloudflare-previews' step 2 says, Cloudflare's with the tool's `pattern`. Done when the method is saved.
-3. **When nothing was saved**, save no method and set up no other preview, whatever the checkup's `next` says, and open no test drive (pull-requests' "No preview, no test drive"). Say under "What is not verified" that the previews are behind the host's lock, with the tool's `reason`, and name the settings page where the person makes the key, or makes the Netlify site public (the report's bullet below); put the person's one step in `left`, the settings action alone and never running the setup again (for Netlify's team login, none: the person was asked in this run, so `left` stays empty and the report names the Visitor access page); end the report's "Not part of this setup" line with the lock the tool met: "Vercel's Deployment Protection in front of the previews", "Netlify's password in front of the previews", "Netlify's team login in front of the previews", or "Cloudflare Access in front of the previews". Done when the report says so.
+   - `save-failed`: the setup API did not take it all; `reason` says how far it got. Call the tool once more; when it fails again, step 3, with "Save the Vercel bypass secret on the setup page", "Type the Netlify site password in the app's Settings, under "A way past your host's lock"" or "Save the Cloudflare service token on the setup page" in `left`.
+2. **Check it from Impeccable's side**: impeccable_write to `connection-check` with `{"appKey": "main"}` (on a repository with several apps, the app's own key: the tool saved the key for that app), and report what it answered. A check that answers `access: "auth-wall"` met the lock all the same: say so under "What is not verified", with its `detail`, and never as verified; the last screen does not call the app set up while it stands. Then go on with the case that sent you here: the proof stands, so save the method as vercel-previews', netlify-previews' or cloudflare-previews' step 2 says, Cloudflare's with the tool's `pattern`. Done when the method is saved.
+3. **When nothing was saved**, save no method and set up no other preview, whatever the checkup's `next` says, and open no test drive (pull-requests' "No preview, no test drive"). Say under "What is not verified" that the previews are behind the host's lock, with the tool's `reason`, and name the settings page where the person makes the key, or makes the Netlify site public (the report's bullet below); put the person's one step in `left`, the settings action alone and never running the setup again (for Netlify's site password: "Type the Netlify site password in the app's Settings, under "A way past your host's lock"", and, with the draft test drive open, "Then mark draft #<n> ready", never a bypass key, which Netlify has none of; for Netlify's team login, none: the person was asked in this run, so `left` stays empty and the report names the Visitor access page); end the report's "Not part of this setup" line with the lock the tool met: "Vercel's Deployment Protection in front of the previews", "Netlify's password in front of the previews", "Netlify's team login in front of the previews", or "Cloudflare Access in front of the previews". Done when the report says so.
 
 ### Reference
 
 - **Before the test drive's push, on Vercel** (pull-requests' step 4): impeccable_vercel_bypass with `beforePush: true`, and the app's `appKey` on a repository with several apps, reads the project's settings and, where Vercel's login will stand in front of the test drive's preview, asks the person now, on a screen naming the project and the app. `protected: false`, or `protected: true` with `consent` `given` or `not-needed`, or `protected: "unknown"`: push. Once the proof meets the gate, step 1 runs as written, and the yes is not asked again. `skipped`: push and open no test drive, and end as step 3 says, with the tool's `reason`.
 - **The report** names, under "What was configured, and by whom", the Vercel project that holds the secret named "Impeccable reviews" (`project`), whether this run created it, found it there or the person typed it, and where it is revoked: the project's Settings → Deployment Protection → Protection Bypass for Automation; or the Netlify site (`site`) whose password is stored, whether this run read it from the site or the person typed it, and where it is changed: the site's Project configuration → General → Visitor access; or, with `opened`, the Netlify site made public, by this run on the person's yes or by the person on Netlify's page (`madePublic`), so anyone with its address opens it, and where it is made private again: the same Visitor access; or the service token named "Impeccable reviews", whether this run created it or the person typed it, the Access application whose policy allows it (`application`), when a created one runs out (`expires`), and where it is revoked: Zero Trust → Access controls → Service credentials → Service Tokens; with `apiToken`, the Cloudflare API token the person made for the run is theirs to delete (dash.cloudflare.com/profile/api-tokens). Revoking, regenerating or changing it stops reviews until a new one is saved on the setup page.
-- **The tool does the writes**: the key as Impeccable's credential for the lock, and the setting that sends it in the host's header (`x-vercel-protection-bypass`, `Authorization`, or `CF-Access-Client-Id` and `CF-Access-Client-Secret`), both through the setup API, so impeccable_write refuses those two. The state's `preview-protection` item words the same calls, and shows `keySaved` once they are done.
+- **The tool does the writes**: the key as Impeccable's credential for the lock, and the setting that sends it (Vercel's `x-vercel-protection-bypass` header, Netlify's password form, or Cloudflare's `CF-Access-Client-Id` and `CF-Access-Client-Secret` headers), both through the setup API, so impeccable_write refuses those two. The state's `preview-protection` item words the same calls, and shows `keySaved` once they are done.
 - **A key saved before** (the item shows `keySaved` and a `check` that `passed`): the lock was handled by an earlier run or the person. Run step 2's check and go on; call the tool only when that check fails. On a repository with several apps, the item's `keySaved` speaks for one app at most: an app whose own proof answered a `gate` gets step 1 with its `appKey`, whatever another app's key did, and its step 2 check is its own.
 - **The key is never yours**: it goes from the command's own process to the host and to Impeccable, and into no message, status line, file, command or report. `vercel project protection`, `vercel api`, `vercel curl` and `netlify api` print it, and the fence refuses them.
 - **The app's own sign-in** is another card: a preview opened past the lock proves nothing about it.

package/dist/tools.js

@@ -10,13 +10,13 @@ import { defineTool } from '@earendil-works/pi-coding-agent';
 import { agreeToHostSetup, bindPreviewPullRequest, chooseHostTeam, chosenHostTeam, classifyPreviewCommand, endHostSetup, hostSetupAgreed, isSecretFile, linkedByRun, observePreviewAttempts, parseCommand, previewRetryState, settleVercelFirstDeployment, vercelProjectsAdded } from './fence.js';
 import { requestJson } from './http.js';
 import { appsLeftOut, focusCheckup, focusInstructions, focusState, severalApps } from './focus.js';
-import { APPS_QUESTION, cloudflareAccessConsent, cloudflareAccessPaste, cloudflareAccessReusable, HOST_QUESTIONS, HOST_SCREENS, HOST_SIGNED_IN, namedAppQuestion, sentTo, startedIn, vercelBypassConsent, vercelBypassPaste } from './host-questions.js';
+import { APPS_QUESTION, cloudflareAccessConsent, cloudflareAccessPaste, cloudflareAccessReusable, HOST_QUESTIONS, HOST_SCREENS, HOST_SIGNED_IN, namedAppQuestion, NETLIFY_PASSWORD_WHERE, netlifySamePassword, sentTo, startedIn, vercelBypassConsent, vercelBypassPaste } from './host-questions.js';
 import { enableNetlifyPreviews, folderOf } from './host-previews.js';
 import { checkoutNames, liveShaped, netlifySiteOf, previewHostName, provePreview, readHostedPreviews, readmeNamesApp, vercelDeploymentOf } from './hosted.js';
 import { cfRunner, cfStatus, CLOUDFLARE_APP_PAGE, connectCloudflareProject, enableCloudflarePreviews, pagesProject, pagesProjectName, readCloudflarePreviews } from './cloudflare.js';
 import { passCloudflareAccess } from './cloudflare-access.js';
 import { commandRunner, connectNetlifySite, liveSite, netlifyStatus, netlifyTeams, readNetlifyPreviews, waitForNetlifyAccess } from './netlify.js';
-import { basicCredentials, PASSWORD_HEADER, passNetlifyLock } from './netlify-password.js';
+import { passNetlifyLock } from './netlify-password.js';
 import { connectVercelProject, lockedDeploymentHosts, prepareFirstDeployment, projectMadeDeployment, readLinkedProject, readOwnProject, vercelDashboardScope, vercelPreviewsFact, vercelProjectFor, vercelProjectPage, vercelRepoProject, vercelStatus, vercelTeams, waitForVercelAccess, waitForVercelLock } from './vercel.js';
 import { BYPASS_HEADER, passVercelLogin, readLink } from './vercel-bypass.js';
 import { fitsTask, stagesOf } from './stages.js';
@@ -123,8 +123,10 @@ export function appsSummary(apps) {
 /** A host's lock in front of a preview, as impeccable_prove_preview names it: how the person reads it, the tool that gets a key past it, and the step left where none was saved (preview-protection's step 3). */
 const LOCKS = {
     'vercel-protection': { lock: "Vercel's login", tool: 'impeccable_vercel_bypass', left: 'Save the Vercel bypass secret on the setup page' },
-    'netlify-protection': { lock: "Netlify's password or team login", tool: 'impeccable_netlify_password', left: 'Save the Netlify site password on the setup page, or make the site public on its Visitor access page' },
+    'netlify-protection': { lock: "Netlify's site password", tool: 'impeccable_netlify_password', left: `Type the Netlify site password in the app's Settings, under "A way past your host's lock"` },
     'cloudflare-access': { lock: 'Cloudflare Access', tool: 'impeccable_cloudflare_access', left: 'Save the Cloudflare service token on the setup page' },
+    // Netlify's gate where its page was the team login, which no key gets past: how the last screen words it (#375).
+    'netlify-login': { lock: "Netlify's team login", tool: 'impeccable_netlify_password', left: `Make the Netlify site public, or give it a password, in ${NETLIFY_PASSWORD_WHERE}` },
 };
 const NO_INPUT = { type: 'object', properties: {}, additionalProperties: false };
 /** Why the status line and the task list say different things, one task in progress at a time and the status its detail; null when they agree. */
@@ -140,7 +142,8 @@ function stageError(status, tasks) {
 }
 /** The line under the last screen's heading, about the pull request that screen ends on: the setup pull request when there is one, else the test drive; and, where a host builds the previews and so no setup pull request was needed, one line saying so. Without a test drive, what stopped it, from what the run saved and met (#321). */
 export function resultLine(report) {
-    const lead = !report.testPr ? `${noTestDrive(report)} The report, printed here when this screen closes, says what the run found.` : report.setupPr ? 'The setup pull request adds the workflow that lets Impeccable run on your previews. Merge it when you are ready.' : SEE_THE_REVIEW;
+    const lead = report.walled ? `Impeccable's own check of the preview met a wall (${report.walled}), so the test drive's review can't see its pages yet. The report, printed here when this screen closes, says what the run found.`
+        : !report.testPr ? `${noTestDrive(report)} The report, printed here when this screen closes, says what the run found.` : report.setupPr ? 'The setup pull request adds the workflow that lets Impeccable run on your previews. Merge it when you are ready.' : SEE_THE_REVIEW;
     return report.setupPr || !report.hostedBy ? lead : `${lead} ${nothingToMerge(report.hostedBy)}`;
 }
 /** Why a run opened no test drive, as far as what it saved and met tells. */
@@ -157,9 +160,12 @@ export function ending(report) {
     // On a repository with several apps, each locked app's own line says it.
     const step = !report.apps && !report.methodSaved && report.lock ? [LOCKS[report.lock].left] : [];
     const todo = [...new Set([...step, ...apps.todo, ...report.left])];
-    if (report.testPr && !apps.notReady.length)
+    if (report.testPr && !apps.notReady.length && !report.walled)
         return { outcome: 'done', title: "You're all set up", todo, code: 0 };
     const outcome = report.methodSaved ? 'partial' : 'stopped';
+    // Impeccable's own check said it can't get in: whatever the run saved, reviews will meet the same wall (#383).
+    if (report.walled)
+        return { outcome, title: "Not set up: Impeccable's check can't get past the preview's wall", todo: [...new Set([`Open the app's Settings: Impeccable's check met ${report.walled}`, ...todo])], code: 1 };
     if (apps.notReady.length)
         return { outcome, title: `${apps.notReady.join(' and ')} ${apps.notReady.length === 1 ? 'is' : 'are'} not set up`, todo, code: 1 };
     const title = report.methodSaved ? 'No test drive opened' : `Not set up: ${report.lock ? `the previews are behind ${LOCKS[report.lock].lock}` : 'no preview method was saved'}`;
@@ -1608,6 +1614,8 @@ export function createTools(ctx) {
     /** Whether any preview write with a method was taken this run, and the host's lock the last gated proof met: the last screen names it when no preview ever opened (#321), and Preview method is completed only once a method is saved (#322). */
     let methodSaved = false;
     let lastLock;
+    /** Netlify's gate, as last met, was its team login rather than the site password: the last screen names that one. */
+    let lastTeamLogin = false;
     /** The host preview addresses a proof or a host's key opened, and the Cloudflare account and Netlify team of each project or site the host tools read, by host and project: the last screen names them (#360), and no tool's answer does. */
     const usedPreviews = new Set();
     const accountOf = new Map();
@@ -1688,15 +1696,18 @@ export function createTools(ctx) {
     const bypassOutcomes = new Map();
     /** The stores whose consent was given before the test drive's push, each with the project it named (`<store>/<projectId>`): the call once the gate is met asks no second time for that project alone. */
     const bypassConsented = new Set();
-    /** The Netlify site password saved in this run, for the proof of that site's addresses to send; never for the model. It is one site's, so it goes only to that site's deploy previews. */
-    let sitePassword;
-    const passwordSites = new Set();
+    /**
+     * The Netlify site passwords saved in this run, by site, for the proof of that site's addresses to send; never for the
+     * model. Each is one site's, so it goes only to that site's deploy previews, and a monorepo's sites keep theirs side by
+     * side (#384): with what the tool answered, whether the person typed it, and the apps it is saved for.
+     */
+    const sitePasswords = new Map();
     /** What impeccable_netlify_password answered for a site, less the password, where the answer stands for the run: a skip is asked once, the team login kept after the retries stays, and a site made public stays public. Another site of the repository is read on its own. */
     const passwordStands = new Map();
     /** The sites whose password the person said yes to storing: a later call for the same site, after a page the app's own sign-in answered, asks no second time. */
     const passwordConsented = new Set();
-    /** The saved answer, what an address the password opens later gets. */
-    let passwordSaved;
+    /** The sites whose last typed password did not open the preview: the paste screen, asked again, says so first (#375). */
+    const passwordRefused = new Set();
     /** The address impeccable_prove_preview met Cloudflare Access's login at, of a Pages preview impeccable_cloudflare_previews listed, and the words it looked for there. */
     let accessGated;
     /** The service token that opened a preview in this run, what the tool said of it, the Pages projects it opened and whether the store holds it: once it does, the proofs of those projects' previews send it; never the model. */
@@ -1802,6 +1813,8 @@ export function createTools(ctx) {
     const provenApps = new Set();
     /** The apps whose preview check (connection-check or latest-pull-check) the setup API answered in this run ('' for the repository): a ready app missing here is named on the last screen (#338). */
     const checkedApps = new Set();
+    /** What Impeccable's own last check of each app's preview met where it did not get in ('' for the repository's), until a later check gets in (#383). */
+    const checkWalls = new Map();
     /** On a repository with several apps (#286): the method each app's preview write saved; the host's lock a proof of each app's preview met; and the apps whose lock was met with no key tool called for them since, which holds every other app's steps until it is. */
     const appMethods = new Map();
     const lockMet = new Map();
@@ -2088,14 +2101,15 @@ export function createTools(ctx) {
      * Saves a host's key for reviews: the key as Impeccable's credential for the lock, then the setting that sends it in
      * `header`, both through the setup API. `stored` says the first write took; `failed` what stopped it, else null.
      */
-    const saveLock = async (pi, what, header, value, appKey) => {
+    /** Saves a host's key as the lock's own credential, then the lock that sends it: a bypass secret in its header, or Netlify's site password, with which reviews sign in on that site's form alone. */
+    const saveLock = async (pi, what, lock, value, appKey) => {
         const base = `${ctx.setupApi}/repos/${encodeURIComponent(ctx.repo)}`;
         // On a repository with several apps, the key is that app's own: each app's previews are its own project's or site's.
         const app = appKey !== undefined ? { appKey } : {};
         if (!(await call(pi, `${base}/preview-auth/protection-header`, { method: 'PUT', body: { value, ...app } })).ok)
             return { stored: false, failed: `The setup API did not store the ${what}.` };
         noteApp(appKey, { key_placed: true });
-        if (!(await call(pi, `${base}/preview-protection`, { method: 'PUT', body: { method: 'header', headerName: header, ...app } })).ok)
+        if (!(await call(pi, `${base}/preview-protection`, { method: 'PUT', body: { ...lock, ...app } })).ok)
             return { stored: true, failed: `The setup API stored the ${what}, but not the setting that sends it: it is turned on under Deployment protection on the setup page.` };
         noteApp(appKey, { method_saved: true });
         return { stored: true, failed: null };
@@ -2223,6 +2237,9 @@ export function createTools(ctx) {
             const proven = provenApps.has(key);
             if (!pickedApps?.has(key))
                 return { key, name, folder, state: 'unpicked' };
+            // Impeccable's own last check of its preview met a wall: its reviews will meet it too (#383).
+            if (method !== undefined && checkWalls.has(key))
+                return { key, name, folder, state: 'walled', left: `${name}: Impeccable's check of its preview met ${checkWalls.get(key)}; open its Settings.` };
             if (method !== undefined && (method !== 'preview-deploy' || proven)) {
                 // With a test drive open, each app's preview is checked once (pull-requests' step 6): one the setup API never answered is named (#338).
                 return ctx.sync.payload.test_pr && !checkedApps.has(key)
@@ -2244,6 +2261,8 @@ export function createTools(ctx) {
             return `- ${where}: not set up. Its previews are behind ${lock}, and no key was saved for it.`;
         if (a.state === 'unset')
             return `- ${where}: not set up. No preview method was saved for it.`;
+        if (a.state === 'walled')
+            return `- ${where}: not set up. Method: ${appMethods.get(a.key)}, but Impeccable's own check of its preview met ${checkWalls.get(a.key)}.`;
         return `- ${where}: not set up this run.`;
     }).join('\n')}`;
     /** Each app's Vercel project, found once a run (a failure is read again, the CLI may have signed in since). */
@@ -2437,6 +2456,16 @@ export function createTools(ctx) {
             // A check that answered, a preview not running yet included, ran for its app; one still turned away did not.
             if (check && (response.ok || response.status === 409))
                 checkedApps.add(typeof object(p.body)?.appKey === 'string' ? String(object(p.body)?.appKey) : '');
+            if (check && response.ok) {
+                // A login wall the check met is the one the review meets: the run is not called set up while it stands (#383).
+                const key = typeof object(p.body)?.appKey === 'string' ? String(object(p.body)?.appKey) : '';
+                const result = object(object(response.data)?.result), pulled = object(object(response.data)?.check);
+                const walled = result?.access === 'auth-wall' || pulled?.outcome === 'sign-in';
+                if (walled)
+                    checkWalls.set(key, typeof result?.detail === 'string' && plainText(result.detail) === result.detail && result.detail.length <= 120 ? `a ${result.detail}` : 'a login wall');
+                else if (result?.access === 'ok' || pulled?.outcome === 'reached')
+                    checkWalls.delete(key);
+            }
             if (target.url.endsWith('/apps') && response.ok && object(p.body)?.action === 'confirm')
                 confirmedApps = true;
             if (target.url.endsWith('/preview') && response.ok) {
@@ -2666,7 +2695,7 @@ export function createTools(ctx) {
             }
             // Otherwise final: a completed write whose answer was lost may still have landed, so it is never taken back.
             const hosts = hostLines(hostsUsed());
-            ctx.onReport({ markdown, left, testPr: drive, setupPr: ctx.sync.payload.setup_pr, ...(savedHost ? { hostedBy: savedHost } : {}), ...(apps ? { apps } : {}), methodSaved, ...(lastLock && !hostedPreviewProven ? { lock: lastLock } : {}), ...(hosts.length ? { hosts } : {}) });
+            ctx.onReport({ markdown, left, testPr: drive, setupPr: ctx.sync.payload.setup_pr, ...(savedHost ? { hostedBy: savedHost } : {}), ...(apps ? { apps } : {}), methodSaved, ...(lastLock && !hostedPreviewProven ? { lock: lastLock === 'netlify-protection' && lastTeamLogin ? 'netlify-login' : lastLock } : {}), ...(!apps && checkWalls.size ? { walled: [...checkWalls.values()].at(-1) } : {}), ...(hosts.length ? { hosts } : {}) });
             pi.shutdown();
             const saved = res?.ok ? 'Saved.' : `The web page did not take it (${res?.error ?? 'no answer'}).`;
             return { text: `${saved} The terminal shows the summary and the command exits.`, terminate: true };
@@ -2905,7 +2934,7 @@ export function createTools(ctx) {
                 fetch: ctx.previewFetch, signal, live: live ? (known?.host ?? true) : false,
                 // The project's bypass secret opens the project's own addresses: the previews it proved, and the production address read from the same project.
                 ...(bypassFor(origin, live) ? { bypass: bypassFor(origin, live) } : {}),
-                ...(sitePassword && site && passwordSites.has(site) ? { password: sitePassword } : {}),
+                ...(site && sitePasswords.has(site) ? { password: sitePasswords.get(site).value } : {}),
                 ...(token ? { access: token } : {}),
             });
             // A live address proven is the before, and nothing else: no method, no pattern and no lock to get past follow from it.
@@ -2916,6 +2945,14 @@ export function createTools(ctx) {
             }
             // On a repository with several apps, the app the address was listed for: its proof, its lock and its key are that app's alone (#281).
             const app = listedApps.get(origin);
+            // A site's password opened the preview of an app it was not saved for (another app built from the same site): it is saved as that app's own before the proof stands, since that app's reviews read its own (#384).
+            const held = site ? sitePasswords.get(site) : undefined;
+            if (proof.proven && held && app && !held.apps.has(app.appKey)) {
+                const saved = await saveLock(pi, 'password', { method: 'password', site: site }, held.value, app.appKey);
+                if (saved.failed)
+                    return JSON.stringify({ proven: false, status: proof.status, appKey: app.appKey, reason: `The site's password opened the preview, but it is not saved for this app: ${saved.failed} Prove this address again to save it.` });
+                held.apps.add(app.appKey);
+            }
             hostedPreviewProven ||= proof.proven;
             if (proof.proven)
                 provenHost = previewHostName(url) ?? provenHost;
@@ -2933,6 +2970,7 @@ export function createTools(ctx) {
             }
             if (proof.gate && Object.hasOwn(LOCKS, proof.gate)) {
                 lastLock = proof.gate;
+                lastTeamLogin = proof.teamLogin === true;
                 // Pristine learns the lock from the session, proven past or not, for a preview it may never meet itself (#365): an app's on its summary, a repository of one app's beside them.
                 const met = { gate: lastLock, preview_host: new URL(url).hostname };
                 // The app is proven again only once something opens it, as `provenApps` has it.
@@ -3244,7 +3282,7 @@ export function createTools(ctx) {
                 ...(signal ? { signal } : {}),
                 prove: async (secret) => sawApp(at.app?.appKey, at.url, await provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, bypass: secret })),
                 save: async (secret) => {
-                    const saved = await saveLock(pi, 'secret', BYPASS_HEADER, secret, at.app?.appKey);
+                    const saved = await saveLock(pi, 'secret', { method: 'header', headerName: BYPASS_HEADER }, secret, at.app?.appKey);
                     stored = saved.stored;
                     return saved.failed;
                 },
@@ -3271,7 +3309,7 @@ export function createTools(ctx) {
             }
             return JSON.stringify(outcome);
         }),
-        tool('impeccable_netlify_password', "Netlify's password", 'Get past the lock that impeccable_prove_preview met (gate "netlify-protection") in front of a Netlify deploy preview, the one way a request can carry Netlify\'s site password: as basic credentials in the Authorization header. It does the rest with the Netlify CLI signed in as the person: it reads the site\'s protection from Netlify, which is what makes the site the person\'s (a site the CLI cannot read as them gets no password: refused, with the reason); for a password Netlify gives back, it shows one screen asking to store it for Impeccable, or, when Netlify does not give the password back, one screen taking a pasted one; opens the preview with it; and saves it for reviews. For a site behind Netlify\'s team login it shows one screen asking to make the site public, signs the Netlify CLI in, in the browser, on that yes where it is signed out, makes it public as the person, and where Netlify refuses opens Netlify\'s Visitor access page with a screen to try again once the person changed it there. Answers {"status": …}: saved (the preview is proven, so the method may be saved; password says whether it was existing or typed, and site which Netlify site it is), opened (the site is public and the preview proven, so the method may be saved; madePublic says whether the run or the person made it public, and on any other answer that the run made it public all the same), login (Netlify kept its team login in front after the retries; reason says so), skipped (the person skipped the screen; reason says what came before), refused (nothing opened the preview; reason says why) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No password ever comes back.', NO_INPUT, async (_p, pi, signal) => {
+        tool('impeccable_netlify_password', "Netlify's password", 'Get past the lock that impeccable_prove_preview met (gate "netlify-protection") in front of a Netlify deploy preview, signed in with Netlify\'s site password on Netlify\'s own form, as reviews sign in (no request header carries it). It does the rest with the Netlify CLI signed in as the person: it reads the site\'s protection from Netlify, which is what makes the site the person\'s (a site the CLI cannot read as them gets no password: refused, with the reason); for a password Netlify gives back, it shows one screen asking to store it for Impeccable, or, when Netlify does not give the password back, one screen taking a pasted one (after one offering the password the person typed for another site of this run, where there is one); opens the preview with it; and saves it for reviews. For a site behind Netlify\'s team login it shows one screen asking to make the site public, signs the Netlify CLI in, in the browser, on that yes where it is signed out, makes it public as the person, and where Netlify refuses opens Netlify\'s Visitor access page with a screen to try again once the person changed it there. Answers {"status": …}: saved (the preview is proven, so the method may be saved; password says whether it was existing or typed, and site which Netlify site it is), opened (the site is public and the preview proven, so the method may be saved; madePublic says whether the run or the person made it public, and on any other answer that the run made it public all the same), login (Netlify kept its team login in front after the retries; reason says so), skipped (the person skipped the screen; reason says what came before), refused (nothing opened the preview; reason says why) or save-failed (the setup API did not take it all; reason says how far it got: call it once more). No password ever comes back.', NO_INPUT, async (_p, pi, signal) => {
             const site = gated?.gate === 'netlify-protection' ? netlifySiteOf(gated.url) : null;
             if (!gated || !site)
                 return 'Refused: this is for a Netlify deploy preview, listed by impeccable_netlify_previews, which impeccable_prove_preview answered with gate "netlify-protection". Prove one first.';
@@ -3280,8 +3318,8 @@ export function createTools(ctx) {
                 lockPending.delete(at.app.appKey);
             /** The address pattern the proof with the password answers, saved as the method once the password is. */
             let pattern;
-            const prove = async (password, form = false) => {
-                const proof = sawApp(at.app?.appKey, at.url, await provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, password, form }));
+            const prove = async (password) => {
+                const proof = sawApp(at.app?.appKey, at.url, await provePreview(at.url, at.expect, pi.cwd, { fetch: ctx.previewFetch, signal, password }));
                 if (proof.proven && proof.pattern)
                     pattern = proof.pattern;
                 return proof;
@@ -3299,15 +3337,25 @@ export function createTools(ctx) {
             }
             else if (stands)
                 return JSON.stringify(stands);
-            // A password in hand already: another deploy preview of the same site opens with it. Another site's lock is read for that site.
-            if (passwordSaved && sitePassword && passwordSites.has(site) && (await prove(sitePassword)).proven) {
+            // A password in hand already: another deploy preview of the same site opens with it, and another app built from the same site gets it saved as its own. Another site's lock is read for that site.
+            const held = sitePasswords.get(site);
+            if (held && (await prove(held.value)).proven) {
+                const store = at.app?.appKey ?? '';
+                if (!held.apps.has(store)) {
+                    const saved = await saveLock(pi, 'password', { method: 'password', site }, held.value, at.app?.appKey);
+                    if (saved.failed)
+                        return JSON.stringify({ status: 'save-failed', site, protection: 'password', reason: saved.failed });
+                    held.apps.add(store);
+                }
                 provePattern(pattern, at.app?.appKey);
                 if (at.app)
                     proveApp(at.app.appKey, at.url);
-                return JSON.stringify(passwordSaved);
+                return JSON.stringify(held.saved);
             }
             /** The store took this attempt's password: what was in hand no longer matches it, unless the setting followed. */
             let stored = false;
+            /** The person typed a password on the paste screen in this call. */
+            let typed = false;
             const { value, ...told } = await passNetlifyLock({
                 run: (ctx.hostRunner ?? commandRunner)('netlify', pi.cwd, { signal }),
                 site,
@@ -3332,21 +3380,36 @@ export function createTools(ctx) {
                     return !(await ask({ ...screen, hint: `${screen.hint} If it did not open, open this link: ${page}` })).skipped;
                 },
                 paste: async () => {
-                    const answer = await ask(sentTo(HOST_SCREENS['netlify-password-key'], at.url));
+                    // One password for several sites is common: the one typed for another site of this run is offered first, once, never after it was refused here (#384).
+                    const other = passwordRefused.has(site) ? undefined : [...sitePasswords].find(([name, h]) => name !== site && h.typed);
+                    if (other && !(await ask(netlifySamePassword(site, other[0]))).skipped) {
+                        typed = true;
+                        return other[1].value;
+                    }
+                    const screen = sentTo(HOST_SCREENS['netlify-password-key'], at.url);
+                    const answer = await ask(passwordRefused.has(site) ? { ...screen, prompt: `The password typed last didn't open the preview on Netlify's form, so nothing was saved. Check it and type it again. ${screen.prompt}` } : screen);
+                    typed = !answer.skipped;
                     return answer.skipped ? undefined : answer.value?.trim();
                 },
                 prove,
                 save: async (password) => {
-                    const saved = await saveLock(pi, 'password', PASSWORD_HEADER, basicCredentials(password), at.app?.appKey);
+                    // Bound to the site the CLI read as the person's: reviews send it to no other site's addresses.
+                    const saved = await saveLock(pi, 'password', { method: 'password', site }, password, at.app?.appKey);
                     stored = saved.stored;
                     return saved.failed;
                 },
                 remember: noteSensitiveAnswer,
             });
             const passwordOutcome = { ...told, ...(told.status === 'saved' || told.status === 'opened' ? { proven: true } : {}) };
-            // Netlify's settings show no lock on the site (none, or none left once it was made public): the last screen blames none (#321).
+            // Netlify's settings show no lock on the site (none, or none left once it was made public): the last screen blames none (#321). Else they say which lock it is.
             if (told.protection === 'none' && lastLock === 'netlify-protection')
                 lastLock = undefined;
+            if (told.protection === 'password' || told.protection === 'team-login')
+                lastTeamLogin = told.protection === 'team-login';
+            if (told.status === 'refused' && typed)
+                passwordRefused.add(site);
+            else if (told.status === 'saved')
+                passwordRefused.delete(site);
             if (told.status === 'skipped' || told.status === 'login' || told.status === 'opened')
                 passwordStands.set(site, passwordOutcome);
             if (told.status === 'opened') {
@@ -3359,23 +3422,18 @@ export function createTools(ctx) {
                 provePattern(pattern, at.app?.appKey);
             }
             if (value) {
-                // What is in hand follows the store: a new password is the one saved now, and the site the last one opened no longer stands.
-                sitePassword = value;
-                passwordSites.clear();
-                passwordSites.add(site);
+                // What is in hand follows the store: the password saved now is this site's, beside every other site's.
+                sitePasswords.set(site, { value, saved: passwordOutcome, typed: told.password === 'typed', apps: new Set([at.app?.appKey ?? '']) });
                 hostedPreviewProven = true;
                 provenHost = 'Netlify';
                 usedPreviews.add(at.url);
                 if (at.app)
                     proveApp(at.app.appKey, at.url);
                 provePattern(pattern, at.app?.appKey);
-                passwordSaved = passwordOutcome;
             }
             else if (told.status === 'save-failed' && stored) {
-                // The store holds the password this attempt wrote without the setting that sends it: nothing in hand stands until a save goes through.
-                sitePassword = undefined;
-                passwordSites.clear();
-                passwordSaved = undefined;
+                // The store holds the password this attempt wrote without the setting that sends it: nothing in hand stands for this site until a save goes through.
+                sitePasswords.delete(site);
             }
             return JSON.stringify(passwordOutcome);
         }),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impeccable/reviews",
-  "version": "0.1.18",
+  "version": "0.1.20",
   "description": "Set up a repository for Impeccable for PRs from your terminal.",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,